Spring Boot 4 Complete Guide · Lesson

JWT-Based Security

Implement token-based authentication using JSON Web Tokens (JWT) for stateless APIs.

JWT-Based Security is a free Spring Boot 4 Complete Guide lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Boot 4 Complete Guide learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Intro to JWT-Based Security

Welcome to the final lesson on Spring Security! Today, we'll explore JSON Web Tokens (JWTs), a popular method for securing stateless APIs.

Unlike traditional session-based authentication, JWTs allow the server to remain stateless, making them ideal for microservices and mobile applications.

What is a JWT?

A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object.

Compact: Small size, can be sent through URL, POST parameter, or inside an HTTP header.
Self-contained: Contains all necessary information about the user, avoiding database lookups for every request.

Anatomy of a JWT

A JWT consists of three parts, separated by dots (.):

Header
Payload
Signature

It typically looks like: xxxxx.yyyyy.zzzzz

The Header: Algorithm & Type

The Header usually consists of two parts: the type of the token (which is JWT) and the signing algorithm being used (e.g., HS256 or RS256).

This JSON is then Base64Url-encoded to form the first part of the JWT.

{"alg":"HS256","typ":"JWT"}

The Payload: Claims

The Payload contains the 'claims' – statements about an entity (typically, the user) and additional data. There are three types of claims:

Registered claims: Standard, non-mandatory claims (e.g., iss for issuer, exp for expiration, sub for subject).
Public claims: Defined by users, require collision-resistant names.
Private claims: Custom claims agreed upon by sender and receiver.

The Signature: Trust & Integrity

The Signature is created by taking the encoded header, the encoded payload, a secret key, and the algorithm specified in the header. It ensures the token hasn't been tampered with.

If someone changes the header or payload, the signature verification will fail, making the token invalid. The secret key must be kept confidential!

Generating JWT Parts (Code)

Let's see how the header and payload are Base64Url-encoded. The signature would then be computed using these encoded parts and a secret.

import java.util.Base64;

public class JwtPartsDemo {
  public static void main(String[] args) {
    String headerJson = "{\"alg\":\"HS256\",\"typ\":\"JWT\"}";
    String payloadJson = "{\"sub\":\"coddyUser\",\"iat\":1678886400,\"exp\":1678890000}";
    
    String encodedHeader = Base64.getUrlEncoder().withoutPadding().encodeToString(headerJson.getBytes());
    String encodedPayload = Base64.getUrlEncoder().withoutPadding().encodeToString(payloadJson.getBytes());
    
    System.out.println("Encoded Header: " + encodedHeader);
    System.out.println("Encoded Payload: " + encodedPayload);
    System.out.println("\nJWT format: EncodedHeader.EncodedPayload.Signature");
  }
}

JWT Flow in Spring Security

When a user successfully authenticates (e.g., logs in with username/password), the server:

Generates a JWT.
Sends the JWT back to the client.

For subsequent requests, the client:

Stores the JWT (e.g., in local storage).
Attaches the JWT in the Authorization header (e.g., Bearer YOUR_TOKEN).

The server then intercepts and validates this token for each protected request.

Validating JWTs (Code Concept)

A custom filter in Spring Security would extract the token, decode its parts, and then critically, verify the signature and validate claims like expiration.

import java.util.Base64;

public class JwtValidationDemo {
  public static void main(String[] args) {
    // A simplified example token (signature part is placeholder)
    String jwtToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJjb2RkeVVzZXIiLCJpYXQiOjE2Nzg4ODY0MDAsImV4cCI6MTY3ODg5MDAwMH0.SIGNATURE_PLACEHOLDER";
    
    String[] parts = jwtToken.split("\\.");
    
    if (parts.length == 3) {
      String decodedHeader = new String(Base64.getUrlDecoder().decode(parts[0]));
      String decodedPayload = new String(Base64.getUrlDecoder().decode(parts[1]));
      
      System.out.println("Decoded Header: " + decodedHeader);
      System.out.println("Decoded Payload: " + decodedPayload);
      
      // In a real application, you would:
      // 1. Verify the 'SIGNATURE_PLACEHOLDER' using the secret key.
      // 2. Parse 'decodedPayload' JSON to check claims like 'exp' (expiration).
      if (decodedPayload.contains("\"sub\":\"coddyUser\"")) {
        System.out.println("Payload contains expected subject 'coddyUser'.");
      }
    } else {
      System.out.println("Invalid JWT format.");
    }
  }
}

Quick Check: JWT Parts

Based on what we've learned, which of the following are standard parts of a JSON Web Token (JWT) that are transmitted?

Recap: JWT-Based Security

In this lesson, we explored JWT-based security, understanding its three key parts: Header, Payload, and Signature.

We learned how JWTs enable stateless authentication, making them highly scalable and suitable for modern APIs and mobile applications. You also saw conceptual code examples for generating and validating JWTs.

This concludes our Spring Security course! You've learned to secure applications from basic authentication to advanced token-based systems.

Frequently asked questions

Is the “JWT-Based Security” lesson free?

Yes — the full text of “JWT-Based Security” is free to read here on the web, and the Spring Boot 4 Complete Guide course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Boot 4 Complete Guide course, upgrade to CoddyKit PRO.

What will I learn in “JWT-Based Security”?

Implement token-based authentication using JSON Web Tokens (JWT) for stateless APIs. You practise Spring Boot 4 Complete Guide with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Spring Boot 4 Complete Guide?

No prior experience is required. Spring Boot 4 Complete Guide on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “JWT-Based Security” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Spring Boot 4 Complete Guide lesson?

Yes. Every Spring Boot 4 Complete Guide lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Spring Boot 4 Complete Guide